Messages in this thread | ![/](/images/icornerl.gif) | | Subject | Re: [PATCH v6 1/1] ns: add binfmt_misc to the user namespace | From | Laurent Vivier <> | Date | Tue, 16 Oct 2018 12:53:11 +0200 |
| |
Le 16/10/2018 à 12:13, Rasmus Villemoes a écrit : > On 2018-10-10 18:14, Laurent Vivier wrote: > >> + /* create a new binfmt namespace >> + * if we are not in the first user namespace >> + * but the binfmt namespace is the first one >> + */ >> + if (READ_ONCE(ns->binfmt_ns) == NULL) { >> + struct binfmt_namespace *new_ns; >> + >> + new_ns = kmalloc(sizeof(struct binfmt_namespace), >> + GFP_KERNEL); >> + if (new_ns == NULL) >> + return -ENOMEM; >> + INIT_LIST_HEAD(&new_ns->entries); >> + new_ns->enabled = 1; >> + rwlock_init(&new_ns->entries_lock); >> + new_ns->bm_mnt = NULL; >> + new_ns->entry_count = 0; >> + /* ensure new_ns is completely initialized before sharing it */ >> + smp_wmb(); >> + WRITE_ONCE(ns->binfmt_ns, new_ns); >> + } > > If ns->binfmt_ns can really change under us (given you use READ_ONCE), > what prevents two instances of this code running at the same time, in > which case one of them would leak its new_ns instance? Also, there
See https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1782780.html
> doesn't seem to be any smp_rmb() buddy to that wmb(), I don't think > that's implied by READ_ONCE() in binfmt_ns().
See https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1783049.html
Thanks, Laurent
| ![\](/images/icornerr.gif) |